devalue 5.9.1 (root, through svelte) and 5.8.1 (site/, through astro)
fall in seven advisories published 2026-10-01 and fixed in 5.9.3, among
them GHSA-j22f-vq7h-c4qm (CVE-2026-92708, high). postcss 8.5.6 (root,
through vite) and 8.5.15 (site/) fall in GHSA-r28c-9q8g-f849
(CVE-2026-73646, high, fixed in 8.5.18) and GHSA-fxqj-rqcc-2cmp (fixed
in 8.5.23); the root copy also in GHSA-6g55-p6wh-862q and
GHSA-qx2v-qp2m-jg93. All of these are build-time dependencies.
Lockfile-only updates inside the existing ranges: npm update devalue and
npm update postcss, in the root and in site/. devalue goes to 5.9.4 and
postcss to 8.5.32, whose own ranges move nanoid to 3.3.20 and
source-map-js to 1.2.2, which clears their advisories as well
(GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-68fv-2mgg-jv7q). The
@types/better-sqlite3 devDependency goes: nothing has imported
better-sqlite3 since the switch to node:sqlite. In site/, npm 10 also
drops five "peer": true markers that the npm which wrote that lockfile
had added; they are metadata only, and npm ci installs the same tree.
Validation:
- npm audit: root 14 advisories before, 10 after; site/ 13 before, 9
after. devalue, postcss, nanoid and source-map-js are gone from both.
- npm run build on main's lockfile and on this one: all 1,264 files of
dist/, the viewer included, are byte-identical. The site builds its
21 pages, and its 101-file dist/ is byte-identical too.
- The release bundle's install (npm ci --omit=dev --ignore-scripts on
the staged lockfile) installs the same 12 packages, file for file.
- All 8 changed resolved/integrity entries match the npm registry's own
metadata and sit on registry.npmjs.org. No git, URL or tarball
sources, and no new install scripts. devalue, postcss and nanoid carry
provenance from their own repositories' release workflows.
Raised by PR 2885 (@johnhldiver-beep) and PR 1477 (@anupamme).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
[skip actions]
* udpated matrix
* feat(site): add landing page + Starlight docs site
Astro + Starlight site in site/ — a flat/paper editorial landing page
plus 18 docs pages seeded from the README. Monochrome theme, hairline
rules, square corners, live GitHub star count, light default + dark
toggle. Deploys to GitHub Pages via .github/workflows/deploy-site.yml.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
